Skip to content
OpenAdvisories

Archive

April 2009

Vulnerabilities first published in this month (UTC), newest first.

← March 2009 2009 / April May 2009 →
  1. 128
  2. 221
  3. 325
  4. 41
  5. 5 
  6. 638
  7. 743
  8. 825
  9. 931
  10. 1032
  11. 11 
  12. 12 
  13. 1318
  14. 146
  15. 1563
  16. 1610
  17. 1732
  18. 18 
  19. 19 
  20. 2011
  21. 2126
  22. 2225
  23. 2325
  24. 2423
  25. 25 
  26. 26 
  27. 2719
  28. 2826
  29. 2923
  30. 3016
All Critical High Medium Low Exploited only Public exploit

567 results · Feed

  • Unscored —
    CVE-2008-6759

    ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via a URL in the POST_DATA p…

  • Unscored —
    CVE-2008-6764 Public exploit

    Cross-site scripting (XSS) vulnerability in login.php in Silentum LoginSys 1.0.0 allows remote attackers to inject arbi…

  • Unscored —
    CVE-2008-6758 Public exploit

    Cross-site request forgery (CSRF) vulnerability in cart_save.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote at…

  • Unscored —
    CVE-2008-6760

    ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add a…

  • Unscored —
    CVE-2008-6761 Public exploit

    Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject a…

  • Unscored —
    CVE-2008-6762

    Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect u…

    wordpress Debian
  • Unscored —
    CVE-2008-6767

    wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cau…

    wordpress Debian
  • Unscored —
    CVE-2008-6763 Public exploit

    login2.php in Silentum LoginSys 1.0.0 allows remote attackers to bypass authentication and obtain access to an arbitrar…

  • Unscored —
    CVE-2008-6765 Public exploit

    ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to access the contents of an arbitrary shopping cart via a m…

  • Unscored —
    CVE-2008-6757 Public exploit

    Cross-site scripting (XSS) vulnerability in manuals_search.php in ViArt Shop (aka Shopping Cart) 3.5 allows remote atta…

  • Unscored —
    CVE-2008-2438 EPSS 11%

    Integer overflow in ovalarmsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote atta…

  • Unscored —
    CVE-2009-1458 Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to…

  • Unscored —
    CVE-2009-1452 Public exploit

    Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execu…

  • Unscored —
    CVE-2009-1459

    Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentica…

  • Unscored —
    CVE-2009-1463

    Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into an…

  • Unscored —
    CVE-2009-1455

    Multiple cross-site request forgery (CSRF) vulnerabilities in WebCollab before 2.50 (aka Billy Goat) allow remote attac…

  • Unscored —
    CVE-2009-1462

    The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user acco…

  • Unscored —
    CVE-2009-1453 Public exploit

    SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remot…

  • Unscored —
    CVE-2009-1461

    Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote auth…

  • Unscored —
    CVE-2009-1454

    Cross-site scripting (XSS) vulnerability in tasks.php in WebCollab before 2.50 (aka Billy Goat) allows remote attackers…

  • Unscored —
    CVE-2009-1457

    Cross-site scripting (XSS) vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject a…

  • Unscored —
    CVE-2009-1456 Public exploit

    Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include an…

  • Unscored —
    CVE-2009-1460

    razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the a…

  • Unscored —
    CVE-2009-1451 Public exploit

    Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary …

  • Unscored —
    CVE-2009-1450 Public exploit

    PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP…

  • Unscored —
    CVE-2008-6755

    ZoneMinder 1.23.3 on Fedora 10 sets the ownership of /etc/zm.conf to the apache user account, and sets the permissions …

    zoneminder Debian
  • Unscored —
    CVE-2008-6756

    ZoneMinder 1.23.3 on Gentoo Linux uses 0644 permissions for /etc/zm.conf, which allows local users to obtain the databa…

    zoneminder Debian
  • Unscored —
    CVE-2009-1448

    Cross-site scripting (XSS) vulnerability in apricot.php in LovPop.net APRICOT, probably 1.20, allows remote attackers t…

  • Medium —
    CVE-2009-1190

    Spring Framework Inefficient Regular Expression Complexity

    Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 t…

    org.springframework:spring-core Maven
  • Unscored —
    CVE-2009-1449 Public exploit

    Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attacke…

  • Unscored —
    CVE-2008-6754

    The Personal Sticky Threads addon 1.0.3c for vBulletin allows remote authenticated users to read the title, author, and…

  • Unscored —
    CVE-2009-1443 Public exploit

    Multiple unspecified vulnerabilities in the Server component in OCS Inventory NG before 1.02 have unknown impact and at…

    ocsinventory-server Debian
  • Unscored —
    CVE-2009-1446 Public exploit

    Unrestricted file upload vulnerability in upload.php in Elkagroup Image Gallery 1.0 allows remote authenticated users t…

  • Unscored —
    CVE-2009-1445 Public exploit

    Multiple directory traversal vulnerabilities in WebPortal CMS 0.8-beta allow remote attackers to (1) read arbitrary fil…

  • Unscored —
    CVE-2009-1447 Public exploit

    Unrestricted file upload vulnerability in admin/editor/image.php in e-cart.biz Free Shopping Cart allows remote attacke…

  • Unscored —
    CVE-2009-1444 Public exploit

    PHP remote file inclusion vulnerability in indexk.php in WebPortal CMS 0.8-beta allows remote attackers to execute arbi…

  • Unscored —
    CVE-2008-6753

    SQL injection vulnerability in SilverStripe before 2.2.2 allows remote attackers to execute arbitrary SQL commands via …

  • Unscored —
    CVE-2009-1440

    Incomplete blacklist vulnerability in DownloadListCtrl.cpp in amule 2.2.4 allows remote attackers to conduct argument i…

    amule Debian
  • Unscored —
    CVE-2009-1436 Public exploit

    The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and 7.2-PRERELEASE does not properly initialize memory for Berk…

  • Unscored —
    CVE-2009-1439

    Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a …